Active Directory & Group Policy
Your JD explicitly requires "Experience with Active Directory & Group Policies". This is the highest-value page in the Windows module.
The concepts
| Term | Meaning |
|---|---|
| Domain | The security boundary. Everything inside trusts everything else. |
| Forest | The top of the hierarchy. One forest = one schema. |
| Tree | One domain and its children |
| Child domain | A separate domain with a two-way trust |
| Organisational Unit (OU) | A container for objects. Policy is applied to OUs, not to domains. |
| Global group | Used for permissions; can span domains |
| Domain local group | Used for resource membership |
| Universal group | Membership stored in AD; for large deployments |
| AGDLP | Global for permissions, Domain Local for resource membership |
| GPO | A collection of settings applied to users or computers |
| Site | A replication grouping, aligned to subnetworks |
"OUs are how you apply Group Policy and delegate administration. Unlike containers, OUs can have Group Policy linked to them, and permissions can be delegated at that level — which is exactly why helpdesk teams get 'create computer objects in the IT OU' rather than Domain Admin."
How a domain login works — Kerberos
Be ready to explain it in three sentences.
- The user types their password. The client contacts the KDC — a service on a domain controller — and requests a TGT (ticket-granting ticket). It encrypts with a hash of the user's password.
- When the user accesses a file server, it presents the TGT. The KDC issues a service ticket for that specific server.
- The client presents the service ticket to the server. Both sides validate it against the shared secret. The password never crosses the network again.
Why this matters operationally
| Fact | What it tells you |
|---|---|
| Tickets are time-limited | Clock skew over 5 minutes breaks authentication |
| TGT renewal | Long sessions renew silently; lockouts are more likely than credential theft from capture |
| NTLM is a fallback | Disabling it without Kerberos working locks everyone out |
klist # view cached tickets
klist /purge # clear them
w32tm /resync # force time sync
nltest /dsgetdc:corp.local # can this machine reach a DC?
Group Policy
A GPO contains settings applied to users or computers, linked to a site, domain or OU.
| Setting type | Applies to | Examples |
|---|---|---|
| Computer Configuration | The machine | Firewall, audit policy, startup scripts, BitLocker |
| User Configuration | The user | Desktop wallpaper, mapped drives, lock screen, app restrictions |
Computer policy always applies to the computer. User policy normally applies to the user's object, even when they log on to a different machine. In Merge mode user policy wins; in Replace mode computer policy wins. This matters for kiosks and locked-down executive workstations.
Policy application order
Site → Domain → Parent OU → Child OU → Local Group Policy.
Later in that chain overrides earlier, except where a link is blocked or enforced:
gpresult /r # report — shows the full order and WHY
gpresult /h out.html # full HTML report
gpupdate /force # re-apply
Nearly always one of four things: the machine is in the wrong OU, a GPO is
blocked by a child OU, loopback processing is set the other way, or the object
is being filtered by security group membership. gpresult /r answers all four
— always run it before you guess.
Common GPOs you would actually deploy
| Policy | Purpose |
|---|---|
| Disable USB storage | Data-loss prevention |
| Force lock screen after 10 min | Compliance |
| Windows Update via WSUS | Patch control |
| Firewall rules | Baseline security |
| Mapped network drives | User convenience |
| Application installation | Standardise business apps |
| Deny local admin | Reduce risk |
Delegation — the helpdesk model
Real support environments never hand out Domain Admin. Instead:
# Give the helpdesk the right to reset passwords and create computers in one OU
dsacls "OU=IT,OU=CORP,DC=corp,DC=local" `
/grant "CORP\Helpdesk":(RP;WDAC;;;0,0,512,268435456)(CI;CR;;;;1131,1275)
# Or, more readably, using PowerShell
Add-ADObjectAce -Identity "OU=IT,DC=corp,DC=local" `
-AccessRuleType Allow `
-AccessControlType Allow `
-Identity "CORP\Helpdesk" `
-ActiveDirectoryRights CreateChild
| Right | Lets them |
|---|---|
| Reset password | Recover locked accounts |
| Create computer objects | Join machines to that OU |
| Read | Troubleshoot who is in what |
When asked "how do you let the helpdesk reset passwords without making them Domain Admins?", the answer is a delegated OU with the Reset password right. It is the single most common day-to-day Active Directory task in support, and it is also the single best answer to demonstrate least-privilege thinking.
"My password is right but it says incorrect"
The full decision tree. This is a real ticket, and it appears in interviews.
net user <username> # is the account locked or disabled?
net user <username> /active:yes # unlock
net user <username> * # reset (prompts for a new password)
Get-ADUser -Identity <user> -Properties LockedOut, Enabled, PasswordExpired
w32tm /resync # clock skew breaks Kerberos
klist /purge # clear stale tickets
| Message | Cause | Fix |
|---|---|---|
| "Account locked out" | Threshold exceeded | Unlock, and reset the password |
| "Password expired" | Age policy | Reset it |
| "Your account has been disabled" | Admin disabled it | Re-enable, confirm why |
| "The trust relationship failed" | DC unreachable or broken trust | nltest /dsgetdc, check the DC |
| Works on Wi-Fi but not LAN | Two network paths, one broken | Compare ipconfig /all on both |
| Works offline | Cached credentials — it was never really locked out | Reset the password |
If a user can log in on a machine that has no network connection, their credentials are cached and the account is not actually failing. The real problem is only visible once they are on the network again. Always ask them to test on the LAN.
Machines and accounts
# Join and unjoin a domain
Add-Computer -DomainName "corp.local" -Credential (Get-Credential)
Remove-Computer -UnjoinDomainCredential (Get-Credential) -Force
# Leave a computer account orphaned by reinstalling the OS
Reset-ComputerMachinePassword -Server dc01.corp.local
It creates a new computer account and leaves the old one behind as an orphan. If a GPO targets the old object, the machine silently stops receiving it. This causes a genuinely baffling support ticket.
GPO troubleshooting
gpresult /r # what applied, and the order
gpresult /r /user # only for the current user
gpresult /r /scope:computer
| Symptom | Check |
|---|---|
| Policy applies to some users only | Security group filtering |
| Wrong values in the wrong OU | Link order, blocked links |
| Machine config ignored | Loopback processing mode |
| Nothing applies at all | Is the machine in the right OU at all? |
Hands-on
Lab 3 — Active Directory & Group Policy builds a domain controller, creates the OU structure, writes two GPOs and breaks them deliberately.
Next
Printers & Peripherals — the most common ticket in the real world.